windows xp数据执行保护（Windows XP data execution protection）.doc

windows xp数据执行保护（Windows XP data execution protection） Detailed description of the windows XP data execution protection (DEP) function, 2008-09-16, 11:52 summary Data execution protection (DEP) is a suite of software and hardware technologies that perform additional checks on memory to help prevent malicious code running on the system. In Microsoft, Windows, XP, Service, Pack 2 (SP2) and Microsoft Windows XP Tablet PC Edition 2005, DEP is enforced by hardware and software together. The main advantage of DEP is that it helps to prevent data pages from executing code. Typically, code is not executed from the default heap and stack. Hardware implements DEP, detects code running from those locations, and raises exceptions when discovery is performed. Software implementation of DEP can help prevent malicious code from using the exception handling mechanism in Windows. Hardware implementation DEP In addition to explicitly containing the memory locations of executable code, the hardware implementation DEP marks all memory locations in the process as non executable. One type of attack is to try to insert code into an executable memory location and run it. DEP can help prevent these attacks by intercepting these attacks and triggering an exception. Hardware implementation DEP relies on processor hardware to use attributes to mark memory, which indicates that the code cannot be executed from that memory. DEP runs as a virtual memory page, typically changing the bits in Page Table Entry (PTE) to mark memory pages. The processor architecture determines how DEP is implemented in hardware, and how DEP tags virtual memory pages. However, when executing code from a page that uses appropriate attribute set tags, a processor that supports hardware implementation of DEP may cause an exception. Advanced, Micro, Devices (AMD) and Intel have defined and published a Windows compliant architecture that is compatible with DEP. Beginning with Windows XP SP2, the 32 bit version of Windows use